Out-of-bounds read in cURL and libcurl - CVE-2017-1000099

Vulnerability identifier: #VU7882

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-1000099

CWE-ID: CWE-125

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to obtain potentially sensitive information.

The weakness exists due to out-of bounds read. A local attacker can load a specially crafted 'file://' URL to cause the curl application to return data from system memory.

Successful exploitation of the vulnerability results in information disclosure.

cURL
libcurl
Arch Linux
Gentoo Linux
Amazon Linux AMI
Slackware Linux
Fedora
curl (Alpine package)
curl

Update to version 7.55.0.

curl (Alpine package) - update to 7.55.0-r0
curl - addressed in versions 7.51.0-9.fc25, 7.53.1-10.fc26

• https://curl.haxx.se/docs/adv_20170809C.html

• Information disclosure in cURL
• Arch Linux update for curl
• Arch Linux update for libcurl-compat
• Arch Linux update for lib32-libcurl-compat
• Arch Linux update for libcurl-gnutls
• Arch Linux update for lib32-libcurl-gnutls
• Arch Linux update for lib32-curl
• Slackware Linux update for curl
• Amazon Linux AMI update for curl
• Out-of-bounds read in curl (Alpine package)
• Gentoo update for cURL
• Fedora 26 update for curl
• Fedora 25 update for curl